---
title: "Search"
method: POST
path: "/api/v1/search/sso/applications"
tags: ["SSO"]
---

# Search

`POST /api/v1/search/sso/applications`

Search SSO applications across the tenant. Supports filtering by the
 applications in your catalog and by display-name or description text.

## Request body

- C1ApiSsoV1SSOApplicationServiceSearchRequest — SSOApplicationServiceSearchRequest searches SSO applications with filters.
  - `appIds` string[], nullable — Optional filter by applications in your catalog. Empty matches any application.
  - `pageSize` integer — Maximum number of results to return per page.
  - `pageToken` string — Pagination token from a previous response.
  - `query` string — Optional text query matched against display_name and description.

## Response `200`

SSOApplicationServiceSearchResponse returns matching SSO applications.

- C1ApiSsoV1SSOApplicationServiceSearchResponse — SSOApplicationServiceSearchResponse returns matching SSO applications.
  - `list` C1ApiSsoV1SSOApplication[], nullable — Matching SSO applications.
    - `appEntitlementId` string — The entitlement a user must hold to sign in. Created with the SSO application and not settable by the caller.
    - `appId` string — The application in your catalog that owns this sign-in configuration. Its owners, entitlements, and access reviews govern who may sign in.
    - `assertionLifetime` string, duration, nullable
    - `createdAt` string, date-time, nullable
    - `description` string — Description of the SSO application.
    - `disabled` boolean — When true, sign-in through this application is refused. The application and its entitlement are left in place.
    - `displayName` string — Display name for the SSO application.
    - `id` string — Unique identifier for this SSO application.
    - `oidc` C1ApiSsoV1SSOApplicationOIDCConfig — SSOApplicationOIDCConfig is the OIDC-specific sign-in configuration.
      - `claimMappings` C1ApiSsoV1OIDCClaimMapping[], nullable — Custom claims released to this application, in addition to the standard claims its granted scopes already release.
        - `claimName` string, required — The name of the claim as the application sees it. Namespace custom claims so they cannot collide with the registered OIDC claim set.
        - `destination` 'OIDC_CLAIM_DESTINATION_UNSPECIFIED' | 'OIDC_CLAIM_DESTINATION_ID_TOKEN_ONLY' | 'OIDC_CLAIM_DESTINATION_USERINFO_ONLY' — Where the claim is released.
        - `userAttributeMappingId` string, required — The user attribute mapping that resolves the value, including its fallback chain.
      - `idTokenSignedResponseAlg` 'OIDC_SIGNING_ALGORITHM_UNSPECIFIED' | 'OIDC_SIGNING_ALGORITHM_EDDSA' | 'OIDC_SIGNING_ALGORITHM_ES256' | 'OIDC_SIGNING_ALGORITHM_RS256' — The algorithm used to sign this application's id_token.
    - `saml` C1ApiSsoV1SSOApplicationSAMLConfig — SSOApplicationSAMLConfig is the SAML-specific sign-in configuration.
      - `acsUrls` string[], nullable, required — The Assertion Consumer Service URLs the assertion may be posted to. Matched exactly; a URL that is not in this list is refused.
      - `attributeMappings` C1ApiSsoV1SAMLAttributeMapping[], nullable — The attributes released in the assertion's AttributeStatement. SAML has no scopes, so this list is the whole release: the NameID carries the identifier and these carry everything else.
        - `friendlyName` string — Optional FriendlyName, for service providers that display it.
        - `name` string, required — The Name attribute, dictated by the service provider.
        - `nameFormat` 'SAML_ATTRIBUTE_NAME_FORMAT_UNSPECIFIED' | 'SAML_ATTRIBUTE_NAME_FORMAT_URI' | 'SAML_ATTRIBUTE_NAME_FORMAT_BASIC' | 'SAML_ATTRIBUTE_NAME_FORMAT_UNSPECIFIED_URN' — The NameFormat attribute.
        - `userAttributeMappingId` string, required — The user attribute mapping that resolves the value, including its fallback chain.
      - `encryptAssertions` boolean — Encrypt the assertion.
      - `encryptionAlgorithm` 'SAML_ENCRYPTION_ALGORITHM_UNSPECIFIED' | 'SAML_ENCRYPTION_ALGORITHM_AES256_GCM' | 'SAML_ENCRYPTION_ALGORITHM_AES128_GCM' | 'SAML_ENCRYPTION_ALGORITHM_AES256_CBC' — The algorithm used when encrypt_assertions is set.
      - `nameIdFormat` 'SAML_NAME_ID_FORMAT_UNSPECIFIED' | 'SAML_NAME_ID_FORMAT_PERSISTENT' | 'SAML_NAME_ID_FORMAT_EMAIL_ADDRESS' | 'SAML_NAME_ID_FORMAT_UNSPECIFIED_URN' | 'SAML_NAME_ID_FORMAT_TRANSIENT' — Set this when the service provider requires a specific NameID format. This also selects the NameID value semantics: EMAIL_ADDRESS uses the user's primary email, TRANSIENT creates a new value for each sign-in, and PERSISTENT uses the application's pairwise subject. Immutable once set.
      - `requireSignedAuthnRequests` boolean — Reject any AuthnRequest that is not signed by one of sp_signing_certificates. At least one signing certificate is required when this is set.
      - `signAssertions` boolean — Sign the assertion. At least one of sign_assertions or sign_responses must be set.
      - `signResponses` boolean — Sign the response envelope. At least one of sign_assertions or sign_responses must be set.
      - `spEncryptionCertificate` string, base64 — The service provider's DER-encoded encryption certificate, taken from the encryption KeyDescriptor in its metadata. Required when encrypt_assertions is set.
      - `spEntityId` string, required — The service provider's entity ID, taken from its metadata. It is the audience every assertion this application issues is restricted to, and it is what the service provider presents at sign-in. Set it at creation: it is fixed for the life of the application, because changing it re-points every assertion already issued. An entity ID already in use by another SSO application in the tenant is rejected.
      - `spSigningCertificates` string[], nullable — The service provider's DER-encoded signing certificates, taken from the signing KeyDescriptors in its metadata.
    - `sectorId` string — The pairwise sector this application belongs to. Empty means the application is its own sector and shares linkability with nothing; set a shared value to issue one identifier across applications a user should appear the same to. Ignored when the subject type resolves to PUBLIC. Immutable once set.
    - `subjectCompatibility` C1ApiSsoV1SSOSubjectCompatibility — SSOSubjectCompatibility configures preservation of subjects issued by a previous identity provider.
      - `userAttributeMappingId` string — Optional user-attribute mapping used to resolve a legacy subject on first sign-in. The resolved value is frozen in an immutable per-user binding. Correct the source attribute before deleting an attribute-derived binding; otherwise the next sign-in resolves and freezes the same value again.
    - `subjectType` 'SSO_SUBJECT_TYPE_UNSPECIFIED' | 'SSO_SUBJECT_TYPE_PAIRWISE' | 'SSO_SUBJECT_TYPE_PUBLIC' | 'SSO_SUBJECT_TYPE_COMPATIBILITY' — How the user's identifier reaches this application.
    - `updatedAt` string, date-time, nullable
  - `nextPageToken` string — Token for the next page.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)